Skip to main content

Website compromised · First aid

Your website has been hacked: what to do now

The six steps below are the ones that matter in the first hours, in the order they matter. You can take them yourself, whether or not you ever talk to Coday. If you need help with them, you can reach Coday’s emergency line by phone or WhatsApp; what it covers is further down.

In short: If your website has been hacked, do three things first: take it offline behind a maintenance page, change every password, including those for the hosting control panel and the domain registrar, and tell your hosting provider. Then look for a backup from before the incident, check whether personal data may be affected and a report to the supervisory authority is needed, and only then decide between cleaning and rebuilding. Coday helps through its emergency line with containing and cleaning the site, and afterwards with rebuilding the site with Next.js, without PHP plugins on the server.

Emergency line: reachable around the clock, including nights and weekends

I work on my own. If I do not pick up, send me the address of your website and what happened through the emergency form on codayweb.de; I get back to you as soon as I see the message. I do not promise a fixed time for my reply.

Call +49 176 41195301Message on WhatsApp (opens in a new tab)
Go to the emergency formWhat the emergency line covers

I tell you what the job costs before I start. The offer is for businesses, associations and the self-employed.

The first six steps

  1. Take the site offline behind a maintenance page

    A compromised site keeps working, but for whoever compromised it: it serves malware to your visitors, sends spam from your domain or hosts a phishing page under your name. Replacing it with a static maintenance page stops the damage from growing while you find out what happened, and it protects the visitors who trusted the address.

  2. Change every password, including the ones nobody thinks of

    The administrator account of the CMS is the obvious one. The ones that tend to be forgotten are the hosting control panel, FTP and SFTP accounts, the database user, the account at the domain registrar, and any deploy keys and API tokens the site uses. If the attacker got in once and only the CMS password changes, the way back in is still open.

  3. Tell your hosting provider

    Many hosting providers have an abuse team that can see server-side logs you cannot reach and can lock the affected account before the damage spreads. Getting in touch with them early is a direct way to find out how the attacker got in.

  4. Find a backup from before the incident, not the newest one

    The most recent backup may already be compromised, because an intrusion is often noticed only some time after it happened. What matters is the last backup taken before the first sign of the attack, which is why the dates in the logs matter more than the dates of the backups. Restore a compromised backup and you restore the attacker with it.

  5. Check whether personal data may have been exposed

    If the breach may have put personal data at risk, Article 33 GDPR requires a report to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. For businesses in Hesse, that authority is the Hessian data protection authority (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit). Contact forms, customer accounts and shop orders all contain personal data. The clock starts when you become aware of the breach, not when you finish investigating.

  6. Decide honestly between cleaning and rebuilding

    Cleaning removes the symptom. If the way in was an outdated plugin, an unpatched core or a weak hosting password, that door is still there after the cleanup, and the site can be infected again. Rebuilding on a system without plugins removes the way in through plugins rather than just the individual infection; the new site needs updates too, and a weak password has to be changed either way (step 2). Which is right depends on how the attacker got in, and that is the question worth answering before money goes into either.

Latest PHP security case: PHP2Shell, 21 October 2026. Check your PHP version, updates and emergency line

How to protect a business website

To protect a business website, use four measures recommended by Germany's Federal Office for Information Security (BSI): two-factor sign-in for every admin login, security updates as soon as they are released, backups kept apart from the website, and administrator rights only for those who need them. Two-factor sign-in belongs not only on the CMS but also on the hosting account and the domain registrar account, because each of them can be used to change the site or point the domain elsewhere.

Install security updates for the CMS, its plugins and extensions automatically where possible, and keep backups apart from the website so that an attacker who gets into the site cannot reach them as well. Administrator rights go only to whoever looks after the site technically: anyone who only edits text works with an editor account, and accounts nobody needs any more are deleted.

Security updates include the PHP version on the server, not just the CMS. For the flaws for which the PHP project released emergency updates on 21 October 2026, the fault lies in PHP itself; according to the BSI, updating the application is therefore not enough, and the PHP version on the server has to be updated. On shared hosting the hosting provider usually applies that update, so ask yours whether PHP on your package has been updated. Source: BSI security notice “PHP: Kritische Schwachstellen bedrohen Webanwendungen weltweit” of 22 October 2026 (opens in a new tab)

What Coday does, and what it does not

During the emergency itself, owner Umutcan Emre Tezgel helps you through Coday’s emergency line. It covers: save a copy of the infected state before I change anything; put the website behind a maintenance page; secure the accounts and have the passwords changed; remove malicious code; apply the PHP update or have the hosting provider switch it; restore a clean backup; talk to your hosting provider. I only work with your instruction and with access you give me. I look for the way in as far as logs and files show it; forensics that will stand up in court is a job for a specialist. On the reporting duty, a lawyer or your data protection officer advises you. I tell you what the job costs before I start. The offer is for businesses, associations and the self-employed.

Afterwards, if you want, Coday rebuilds the site so the same thing cannot happen the same way. The new site is built with Next.js, and its pages are generated ahead of time and served from a CDN, with no PHP plugins on the server that need patching. That does not make a website unhackable, because nothing does, but it removes the entry points that automated attacks aim at: outdated plugins and PHP code on the server.

A rebuild after a compromise runs like any other relaunch: the fixed price is in the quote before the work starts, and you follow the interim versions through a preview link. One thing is specific to it: the spam URLs the attacker injected have to stop working instead of being redirected somewhere.

Questions after a hack

How did my website get hacked?

The usual ways into a plugin-based CMS are an outdated extension, a core installation that missed a security update, a reused or weak password on the hosting account, and FTP login details stolen from an infected work computer. A flaw in PHP itself can be the way in too. For the flaws for which the PHP project released emergency updates on 21 October 2026, updating the application, such as WordPress, is not enough according to Germany’s Federal Office for Information Security (BSI); the PHP version on the server has to be updated (BSI security notice “PHP: Kritische Schwachstellen bedrohen Webanwendungen weltweit” of 22 October 2026). Attacks mostly run automatically and target widespread systems such as WordPress, not because WordPress is badly built, but because a weakness in a widespread system can be exploited on many sites at once.

Can I just clean the site and carry on?

Sometimes, and it is worth trying when the way in is known and has been closed. It fails when the way in is unknown, because cleaning removes the files the attacker left behind, not the hole they came through. In that case the site can be infected again. The question that decides it is not “is the site clean now?” but “do we know how they got in?”

Does Coday remove malware from a hacked website?

Yes, through Coday’s emergency line. It covers: save a copy of the infected state before I change anything; put the website behind a maintenance page; secure the accounts and have the passwords changed; remove malicious code; apply the PHP update or have the hosting provider switch it; restore a clean backup; talk to your hosting provider. I only work with your instruction and with access you give me. I look for the way in as far as logs and files show it; forensics that will stand up in court is a job for a specialist. On the reporting duty, a lawyer or your data protection officer advises you. I tell you what the job costs before I start. Afterwards, if you want, Coday rebuilds the site with Next.js, with pages generated ahead of time and no PHP plugins, so that the way in through plugins is gone, not just the individual infection.

Do we have to report a hacked website to the authorities?

A report is required when the breach put personal data at risk. Article 33 GDPR then requires a report to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and Article 34 also requires you to inform the affected people themselves when the risk to them is high. A site with nothing but company information and no forms may fall outside this; a site with a contact form, customer accounts or orders usually does not. If you are unsure, that uncertainty is itself a reason to get legal advice quickly rather than wait.

Will our Google rankings recover after a hack?

They can, but not on their own and not immediately. A compromised site can be flagged as harmful in Search Console and shown with a warning in search results, and the spam pages an attacker injects can be indexed under your domain. Recovery means removing the injected content, requesting a review in Search Console, and making sure the injected URLs return a clear “gone” or “not found” status instead of continuing to work.

More on relaunching a website:
Website RelaunchRelaunch checklistWhat a relaunch costsWebsite Migration & Replatforming

Emergency line · straight to the owner

Website hacked? Report the emergency

Send me the address of your website and what happened. If it is urgent, call or send a WhatsApp message; both are at the top of this page. I tell you what the job costs before I start. The offer is for businesses, associations and the self-employed.

  1. 01

    Report the emergency

    Name, phone or e-mail, and in the message the address of your website and what happened.

  2. 02

    Contain and secure

    With your instruction and the access you give me: save a copy of the infected state, put the site behind a maintenance page, secure the accounts.

  3. 03

    Clean up, then rebuild if you want

    Remove malicious code, apply the PHP update, restore a clean backup; afterwards, if you want, a rebuild without PHP plugins.

  • Price on request, named before I start
  • Personally from the owner
  • Only with your instruction
Personal reply from the owner

Quick request

Three fields are enough. I will get back to you in person.

By sending you agree that I use your details to handle your request. No sharing, no advertising. Privacy

Reviews on Google(opens in a new tab)Reviews on ProvenExpert(opens in a new tab)